How to verify if your Supabase is publicly writable (safely)

A safe approach to checking whether public INSERT is possible without leaving meaningful data behind.

“Is this table writable from the public internet?” is a high-impact question. The tricky part is verifying it without accidentally inserting real data.

Use a minimal insert probe

When possible, send an INSERT with minimal payload and request minimal return data. If the backend supports transaction rollback (or you can write into a disposable table), you can confirm writability without lasting changes.

Treat write access as urgent

Public write access can enable spam, data corruption, or privilege escalation depending on what the table controls. Fixes typically involve enabling RLS and tightening INSERT/UPDATE policies.

Supaguard’s scanner uses a “single insert probe” approach designed to confirm permissions without meaningful writes.